CVE-2016-10521: Regular Expression Denial of Service in jshamcrest

Background

The jshamcrest package is an npm package that provides a set of matchers for JavaScript. It is used for writing expressive and readable assertions in tests. The package allows developers to define custom matchers and use them in their test cases. However, the package is vulnerable to a regular expression denial of service (ReDoS) attack when certain types of user input are passed to the emailAddress validator.

Vulnerability Detail

The vulnerability in the jshamcrest package arises from the way the emailAddress validator handles certain types of user input. When a specially crafted input is provided, the regular expression used by the validator can be exploited to cause a denial of service. An attacker can send a malicious email address that triggers excessive backtracking in the regular expression engine, leading to a significant slowdown or even a complete halt of the application. This can result in a denial of service, impacting the availability of the affected system.

The proof of concept code provided demonstrates how an attacker can exploit this vulnerability by generating a long string of characters in the local part of the email address. The length of the string required to cause a significant event loop block varies, but it has been observed that a string of around 116 characters can result in a 1.6-second event loop block.

This vulnerability was identified in October 2015, and the maintainers of the jshamcrest package were notified. However, no patched versions have been released to address this issue.

Workaround

As a workaround, developers can manually validate email addresses using a different approach that is not vulnerable to regular expression denial of service attacks. One option is to use a well-tested and widely-used email validation library that has been specifically designed to handle potential ReDoS attacks. By replacing the jshamcrest package with such a library, developers can mitigate the risk of this vulnerability.

Here is an example of how to use the validator module as an alternative to jshamcrest for email address validation:

var validator = require('validator');

var isValidEmail = validator.isEmail('example@example.com');

if (isValidEmail) {
  console.log('Email address is valid');
} else {
  console.log('Email address is invalid');
}

Conclusion

The jshamcrest package is vulnerable to a regular expression denial of service attack when certain types of user input are passed to the emailAddress validator. This can result in a denial of service, impacting the availability of the affected system. Currently, there are no patched versions available, and the best mitigation strategy is to use an alternative module that provides similar functionality and is actively maintained. It is important to address this vulnerability to ensure the security and availability of the affected systems.

For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for jshamcrest →

FAQ